ABSTRACT OF THE DISCLOSURE 
[0029] Intrusion prevention for a computer is based on intrusion rules corresponding to 
active networked applications executing on the computer. The intrusion rules are a subset 
of a full ruleset that may include signatures of known attacks or heuristic rules. The subset 
changes as network connections for active applications are initiated and terminated, or as 
the active applications terminate. 
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